TRM Labs and Zscaler Unite to Track Ransomware on the Blockchain
Two of the most closely watched names in threat intelligence have formalised a partnership that links malware tradecraft directly to cryptocurrency money flows. TRM Labs, known for its on-chain analytics, and Zscaler ThreatLabz, which specialises in cyber threat intelligence, announced on 6 October 2026 that they are combining their datasets to investigate ransomware groups, nation-state actors, and other cybercriminals who rely on digital assets to fund and monetise attacks. For accounting firms, auditors, and CFOs who depend on reliable crypto accounting software and robust AML controls, the data this partnership has already produced carries immediate practical weight.
What the Partnership Actually Does
Cyber threat intelligence and on-chain intelligence have traditionally lived in separate silos. A malware analyst can describe how a ransomware group operates, which infrastructure it uses, and how its tactics shift over time. A blockchain analyst can trace cryptocurrency flows between wallets. What neither discipline could easily do alone is connect a specific attack campaign to a specific set of wallet addresses and then follow the money as it moves through exchanges, mixers, or cross-chain bridges.
Closing the Attribution Gap
The TRM Labs and Zscaler ThreatLabz collaboration is designed to close exactly that gap. ThreatLabz contributes malware code analysis, attacker behaviour profiling, and documentation of evolving tactics, techniques, and procedures. TRM Labs maps the on-chain financial activity associated with the same threat actors, tracing how ransom payments move once victims pay and how proceeds are eventually cashed out or recycled into further criminal infrastructure.
The two teams say their combined intelligence has already produced measurably better ransomware analytics by connecting operational attack activity with victim payment data, something that was significantly harder when each organisation worked from its own data in isolation.
Four Defined Focus Areas
The partnership has outlined four workstreams that will structure ongoing collaboration:
- Ransomware ecosystem analysis: continuous tracking of leading ransomware groups, their affiliate networks, and emerging families, including shifts in monetisation strategy.
- Blockchain technology abuse: investigation of techniques such as EtherHiding, where threat actors use blockchain infrastructure as a resilient command-and-control fallback, making takedowns significantly harder.
- Nation-state research: linking state-sponsored attack campaigns to specific cryptocurrency transactions, providing attribution evidence that neither team could produce independently.
- Intelligence sharing and reporting: enriching active investigations with validated findings and disseminating results to the broader security and compliance community.
The Numbers Behind the Ransom Economy
The partnership's first joint output is the ThreatLabz 2026 Ransomware Report, which analyses known victim ransom payments from April 2025 through March 2026. The headline figures are stark.
Key Data Points From the 2026 Report
| Metric | Value |
|---|---|
| Total known ransom payments (12 months to March 2026) | USD 327.8 million |
| Average payment per victim | USD 431,900 |
| Year-on-year change in average payment | +5.3% |
These are known payments only. The actual total is likely higher, since many victims do not publicly disclose payments and some transactions are only partially attributed. The figures nonetheless represent a meaningful lower bound and confirm that the ransom economy is not contracting despite increased law-enforcement activity globally.
The year-on-year rise in average payment is particularly relevant for risk modelling. It suggests ransomware operators are either targeting larger organisations, becoming more effective at extracting higher sums from victims of similar size, or both. For any business holding or transacting in digital assets, that trajectory affects insurance pricing, incident response budgeting, and the cost-benefit calculus of preventive controls.
Nation-State Actors and the Blockchain Dimension
Beyond ransomware, the partnership specifically calls out nation-state actors as a second major focus. State-sponsored groups have increasingly used cryptocurrency to fund operations, evade sanctions, and convert proceeds from cyber theft into usable resources. The challenge for investigators has always been attribution: proving that a wallet cluster belongs to a specific state-backed group requires both technical malware indicators and on-chain financial evidence.
Why Attribution Matters for Compliance Teams
For regulated businesses, particularly virtual asset service providers, banks with digital asset desks, and corporates holding crypto on their balance sheet, the attribution question has direct AML consequences. Receiving funds that can be linked to a sanctioned state actor, even unknowingly, can trigger sanctions exposure. The more precisely threat intelligence can attribute wallet addresses to nation-state groups, the more effectively compliance screening tools can flag those addresses before a transaction settles.
Teams managing crypto bookkeeping software and transaction monitoring systems should note that this partnership is expected to produce new indicators of compromise and wallet attribution data that will eventually flow into blockchain analytics tools used for compliance screening. Staying current with those updates is part of a defensible AML programme.
Understanding how the ZachXBT Lazarus network infiltration reshapes crypto AML for firms provides useful context on the specific tradecraft used by one of the most active state-affiliated groups and the on-chain patterns their laundering leaves behind.
EtherHiding and Blockchain Infrastructure Abuse
One of the more technically specific elements of the partnership's stated scope is EtherHiding, a technique where malicious actors embed command-and-control instructions inside blockchain transactions or smart contract storage. Because blockchain data is immutable and globally distributed, it is far harder for defenders to take down than traditional hosting infrastructure. A threat actor can write malicious payload delivery instructions into a smart contract and retrieve them from any device anywhere in the world, with no centralised server to seize.
Accounting and Audit Implications
For auditors reviewing clients with significant on-chain exposure, this matters beyond cybersecurity. If a client's digital asset infrastructure has interacted with contracts or addresses associated with EtherHiding campaigns, those interactions may need to be assessed for regulatory disclosure purposes and could affect the auditor's assessment of the control environment around digital asset accounting software. Blockchain-level forensic review is becoming a more realistic expectation for audits of crypto-native businesses.
The broader pattern of criminals exploiting blockchain infrastructure for operational resilience is also covered in our analysis of AML red flags compliance teams must know after crypto bridge hacks, which documents how similar infrastructure abuse shows up in the context of bridge exploits.
Continuity Across Rebrands: The Ransomware Tracking Problem
Ransomware groups are notoriously difficult to track over time because they rebrand, splinter into affiliate operations, and rebuild infrastructure after law-enforcement disruption. A group that is shut down under one name frequently re-emerges under another, often retaining the same core developers, affiliates, and cryptocurrency laundering channels.
How the Combined Dataset Helps
ThreatLabz's malware code analysis can identify shared code libraries and infrastructure patterns that link a new group to a previous one, even when branding and ransom note language have changed entirely. TRM Labs' on-chain data can then confirm whether the new group is using wallet infrastructure that overlaps with the old one, whether the same money laundering patterns appear, and whether the same cash-out channels are being used. Together, these two sources of evidence make it significantly harder for a group to escape its history simply by changing its name.
For compliance teams, this means that wallet blocklists and OFAC SDN additions associated with a defunct group remain relevant even after a rebrand, and that attribution evidence from the combined partnership reporting may be used to support sanctions designations of successor entities.
Practical Steps for Accounting Firms, Auditors, and CFOs
The partnership's findings and ongoing intelligence outputs have several direct implications for professionals who manage or audit digital asset positions.
For Accounting Firms and Auditors
Client onboarding and periodic review procedures for crypto-native clients should incorporate checks against newly attributed wallet clusters as they are published by intelligence sources. Audit programmes for digital asset accounting should include a specific step assessing whether transaction monitoring systems are being updated with current threat intelligence, not just regulatory watchlists. Where clients have suffered ransomware incidents and made cryptocurrency payments, those payments carry specific accounting treatment questions: the payment itself needs to be recorded at fair value on the date of settlement, any cryptocurrency purchased specifically to pay the ransom will trigger a taxable disposal in most jurisdictions if it was not already held, and the payment may need to be disclosed in the financial statements depending on materiality and the jurisdiction's reporting requirements.
For CFOs at Crypto-Exposed Businesses
The 5.3% year-on-year rise in average ransom payments should factor into cyber insurance renewal negotiations and incident response budget planning. Businesses that hold cryptocurrency on their balance sheet are a more attractive target than those that do not, because they already have the infrastructure to acquire and transfer digital assets quickly. CFOs should confirm with their security teams that transaction monitoring controls and AML policies specifically address the scenarios documented in the ThreatLabz 2026 Ransomware Report, including the use of blockchain infrastructure for command-and-control and the layered laundering patterns associated with nation-state actors. Digital asset accounting software used internally should be assessed for its ability to flag transactions touching known illicit wallets at the point of recording, not only retrospectively.
For Compliance Officers at VASPs
Virtual asset service providers face the most direct regulatory exposure from this landscape. The partnership between TRM Labs and Zscaler ThreatLabz is expected to produce updated attribution data that feeds into screening tools. Compliance officers should confirm their vendor update cadence and ensure that newly attributed addresses are reflected in screening systems within the timeframe required by their AML programme. Any transaction monitoring alerts involving wallet addresses later attributed to ransomware or nation-state actors should be reviewed under the lens of the enhanced due diligence obligations applicable in the relevant jurisdiction, even if the original alert was closed as low-risk before the attribution was published.
Frequently Asked Questions
What does the TRM Labs and Zscaler ThreatLabz partnership produce in practical terms?
The collaboration produces joint threat intelligence reports, enriched wallet attribution data, and analytical frameworks that link specific malware campaigns to on-chain cryptocurrency flows. The first output is the ThreatLabz 2026 Ransomware Report, which covers ransom payments from April 2025 to March 2026.
How does the $327.8 million ransom total affect AML risk assessments?
It confirms that the ransom economy is growing, not contracting. For AML risk assessments, this means the probability that a business or its counterparties will encounter ransomware-linked transactions is higher than it was a year ago. Risk ratings for crypto-exposed clients and transaction corridors involving high-risk jurisdictions should reflect that trend.
What is EtherHiding and why does it matter for auditors?
EtherHiding is a technique that embeds malicious command-and-control instructions inside blockchain data, making the infrastructure effectively un-takedownable. For auditors, it raises the question of whether a client's smart contract interactions have inadvertently touched contracts used as part of this infrastructure, which could have implications for the audit of the client's internal controls and regulatory disclosures.
If a company pays a ransom in cryptocurrency, how should that be recorded?
The ransom payment should be recorded as an expense at the fair value of the cryptocurrency on the date of payment. If cryptocurrency was acquired specifically to make the payment and was not previously held as a digital asset, the acquisition and disposal may itself be a taxable event depending on the jurisdiction. The payment may also require separate disclosure in the financial statements if it is material, and legal counsel should be consulted on any reporting obligations to law enforcement or regulators.
Will the new attribution data automatically update compliance screening tools?
Not automatically. Compliance teams need to confirm the update cadence of their screening vendors and ensure that newly attributed wallet addresses from reports like the ThreatLabz 2026 Ransomware Report are incorporated promptly. A defensible AML programme requires documented processes for how external intelligence feeds are reviewed and applied to transaction monitoring rules.
Source: TRM Labs